filesystem: Add labeling for pidfs.

[pebenito]

Add task SID labeling for pidfs, which is the new backing pseudo filesystem for pidfds.

The existing rules will allow domains to open pidfds and use them internally, but other domains will require additional access (fd and file) when passing around the pidfd.